Bug 12863 - Commit "smbclient -L can't do workgroup listing over SMB2/3" and SMB2 only remote computers
Commit "smbclient -L can't do workgroup listing over SMB2/3" and SMB2 only re...
Status: ASSIGNED
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Tools
unspecified
All All
: P5 regression
: 4.7
Assigned To: Karolin Seeger
Samba QA Contact
:
Depends on:
Blocks: 12876 12881
  Show dependency treegraph
 
Reported: 2017-06-24 18:13 UTC by Giulio
Modified: 2017-08-22 17:50 UTC (History)
3 users (show)

See Also:


Attachments
git-am cherry-pickx from master. (7.29 KB, patch)
2017-08-21 21:27 UTC, Jeremy Allison
metze: review+
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Giulio 2017-06-24 18:13:38 UTC
I have a Win10 computer with SMB1 disabled.

Before commit https://git.samba.org/?p=samba.git;a=commitdiff_plain;=2726c1a1b0c69d618248b607eca2b0845ddda41d:

$ smbclient -L win10 -Uuser%pass -m smb2
...
...
        IPC$            IPC       IPC remoto
        print$          Disk      Driver della stampante
Domain=[WIN10] OS=[] Server=[]
 
        Server               Comment
        ---------            -------
 
        Workgroup            Master
        ---------            -------
$
Looking normal

================================================

After commit https://git.samba.org/?p=samba.git;a=commitdiff_plain;=2726c1a1b0c69d618248b607eca2b0845ddda41d:

$ smbclient -L win10 -Uuser%pass -m smb2
...
...
       IPC$            IPC       IPC remoto
       print$          Disk      Driver della stampante
protocol negotiation failed: NT_STATUS_CONNECTION_RESET      <======= Now I may think I have a problem, even if I don't
NetBIOS over TCP disabled -- no workgroup available

$
==========================================================

If the remote computer supports NT1 then everything is OK.

==========================================================

Maybe
   if PROTOCOL_NT1 >= remote_machine_min_protocol
   then
        max_proto = MIN(max_protocol, PROTOCOL_NT1);
   else
        do as before
Comment 1 Stefan Metzmacher 2017-06-26 12:26:02 UTC
This should improve the situation:
https://git.samba.org/?p=samba.git;a=commitdiff;h=2726c1a1b0c69d618248b607eca

Can you verify that?
Comment 2 Stefan Metzmacher 2017-06-26 12:28:21 UTC
(In reply to Stefan Metzmacher from comment #1)

Ah, ok, that commit is actually your problem...
Comment 3 Stefan Metzmacher 2017-06-26 12:32:32 UTC
(In reply to Stefan Metzmacher from comment #2)

Can you check the server logs for any PANIC backtrace message?
Comment 4 Giulio 2017-06-26 12:57:10 UTC
(In reply to Stefan Metzmacher from comment #3)

In this case the server is Windows 10 with SMB1 disabled, I think by "panic" you meant samba server?

The client is smbclient, so nothing is logged in samba logs.

The problem is not of functionality, but of confusion in seeing an unexpected new smbclient error:

- I run smbclient connecting to Windows 10, telling smbclient to use SMB2 with "-mSMB2" because I know that that particular Win10 is SMB2 only.

- before the commit: I'd see clean smbclient output

- after the commit: smbclient will show an error because it tries SMB1 against an SMB2/3 only Windows PC;
this error could be confusing to users who could think something is wrong, even if everything is actually OK.

===========

The reason I'm doing this tests is because I read that by the end of the year is possible that new Windows 10 "clean installs" (not upgrades) will have SMB1 disabled by default, so I wanted to test smbclient interactions with a SMB2/3 only Windows 10.
https://www.bit-tech.net/news/bits/2017/06/19/microsoft-disable-smbv1-redstone-3/1/
Comment 5 Stefan Metzmacher 2017-06-26 13:03:52 UTC
(In reply to Giulio from comment #4)

Can you find the exact commit that changes the behavior?
The one you reference only changes the smbd.

It might be the commit I referenced:
https://git.samba.org/?p=samba.git;a=commitdiff;h=2726c1a1b0c69d618248b607eca

I would be good to have tcpdump catures + -d10 output of smbclient
for both cases.

We hopefully change "client max protocol" to SMB3_11 for the 4.7.0 release
in September.
Comment 6 Giulio 2017-06-26 13:46:52 UTC
(In reply to Stefan Metzmacher from comment #5)

Yes, sorry for the mixup

The commit I was referring to is
s3:client: smbclient -L can't do workgroup listing over SMB2/3
https://git.samba.org/?p=samba.git;a=commitdiff;h=2726c1a1b0c69d618248b607eca
the part with 
   int max_proto = MIN(max_protocol, PROTOCOL_NT1);
Comment 7 Stefan Metzmacher 2017-07-03 09:48:01 UTC
(In reply to Giulio from comment #6)

Using "server min protocol = SMB2_02" reproduces the bug:

# bin/smbclient -L 127.0.0.1 -U%

        Sharename       Type      Comment
        ---------       ----      -------
        netlogon        Disk      
        sysvol          Disk      
        IPC$            IPC       IPC Service (Samba 4.7.0pre1-DEVELOPERBUILD)
protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE
NetBIOS over TCP disabled -- no workgroup available
Comment 8 Nagendra.V.S 2017-07-03 10:39:49 UTC
(In reply to Stefan Metzmacher from comment #7)
I have tried setting "server min protocol = SMB2" on smbd version 4.6.5 & I have observed the same/similar problem. 

smbclient version 4.6.5 reports the following error

protocol negotiation failed: NT_STATUS_INVALID_PARAMETER_MIX

smbclient version 4.5.10 reports the following error

protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE

Using -m SMB2 with smbclient suppresses this error, however I still see Giulio problem on the already released versions of Samba
Comment 9 Stefan Metzmacher 2017-07-04 19:34:01 UTC
Maybe https://bugzilla.samba.org/show_bug.cgi?id=12061 is related
Comment 10 Stefan Metzmacher 2017-08-16 07:02:25 UTC
(In reply to Stefan Metzmacher from comment #7)

I best think we can do is something like this:

$ bin/smbclient -L 172.31.9.163 -Uadministrator%A1b2C3d4                                                                 

        Sharename       Type      Comment
        ---------       ----      -------
        netlogon        Disk      
        sysvol          Disk      
        IPC$            IPC       IPC Service (Samba 4.6.6-SerNet-Ubuntu-11.trusty)
Reconnecting with SMB1 for workgroup listing.
protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Failed to connect with SMB1 -- no workgroup available

$ bin/smbclient -L 172.31.9.163 -Uadministrator%A1b2C3d4 --option="clientminprotocol=SMB2_02"

        Sharename       Type      Comment
        ---------       ----      -------
        netlogon        Disk      
        sysvol          Disk      
        IPC$            IPC       IPC Service (Samba 4.6.6-SerNet-Ubuntu-11.trusty)
SMB1 disabled -- no workgroup available

$ bin/smbclient -L 172.31.9.163 -Uadministrator%A1b2C3d4 --option="disablenetbios=yes"

        Sharename       Type      Comment
        ---------       ----      -------
        netlogon        Disk      
        sysvol          Disk      
        IPC$            IPC       IPC Service (Samba 4.6.6-SerNet-Ubuntu-11.trusty)
NetBIOS over TCP disabled -- no workgroup available
Comment 11 Jeremy Allison 2017-08-21 21:27:10 UTC
Created attachment 13486 [details]
git-am cherry-pickx from master.
Comment 12 Stefan Metzmacher 2017-08-22 06:24:50 UTC
Comment on attachment 13486 [details]
git-am cherry-pickx from master.

These also fix bug #12876 and #12881.
Comment 13 Jeremy Allison 2017-08-22 17:50:04 UTC
Re-assigning to Karolin for inclusion in 4.7.0.